Slopsquatting: Weaponizing AI Package Hallucinations
Code-gen LLMs confidently invent non-existent package names — and repeat the same fake names reliably. Attackers register those hallucinated packages with malware, so developers who paste AI suggestions install the payload themselves.
What happened
Slopsquatting turns an LLM weakness into a supply-chain attack. Code-generation models routinely hallucinate package names — plausible-sounding dependencies that don’t exist — and crucially they do so repeatably: studies of ~756,000 AI code samples found nearly 20% referenced non-existent packages, and the same fake name often recurred across queries.
An attacker simply registers the hallucinated name on a public registry and fills it with
malware. Developers who trust AI-suggested imports then install it themselves. Security
researcher Bar Lanyado proved the risk concretely: he registered one commonly-hallucinated
package (huggingface-cli) as an empty PoC and it drew 30,000+ downloads in three months
with zero promotion. Researchers have catalogued over 200,000 unique hallucinated names.
Why it maps to ATLAS
- AML.T0062 — Discover LLM Hallucinations: the attacker probes models to find repeatable hallucinated package names.
- AML.T0060 — Publish Hallucinated Entities: those names are registered as real (malicious) packages.
- AML.T0011.001 — User Execution: Malicious Package: developers install and run the package on an AI suggestion.
Detection notes
The exploit rides developer trust in AI output. Enforce lockfiles and dependency allowlists, verify that every AI-suggested package genuinely exists and is reputable before installing, and watch for installs of newly-registered packages that match known hallucination patterns. Registry operators can proactively detect and hold hallucination-named packages.
Detection
Log sources
- Dependency-resolution + install logs
- Package-registry download telemetry
- AI-suggested-import provenance
Signals
- Installs of newly-registered packages matching common AI hallucinations
- Dependencies with no history that appear right after AI code suggestions
- Package names that are plausible but absent from lockfiles/known sets
Mitigations
- Lockfiles + allowlists; verify every AI-suggested dependency exists and is trusted
- Registry-side detection of hallucination-named packages
- Human review of AI-generated import statements before install